SIM/USIM Research Materials

Research Materials
I shall be posting material (example below) I have gathered from my research over the last 20 years that students, examiners and experts may find of use. Some of the materials to be posted I couldn't find when I searched the Internet recently. Whether that is down to me not searching enough or information held in web-based wall-gardens or the information is no longer available, it would be a pity to let that research fade into obscurity. Where I can identify authors of materials posted I shall do so. But if I cannot do that then by posting I am not declaring someone elses work or their material are my creation. I am just sharing what is and in some case what was freely distributed over the years. 

Trial and Error
When considering historical material it can provide a useful background insight, whilst at the same time nuture the interest to experiment and offers a knowledge base that may be needed or useful to know when approaching trial and error tests/experimentation.

Past Solutions Future Answers
One last point. A re-occuring theme, when considering digital evidence or forensic methodology or, even, how to apply examination techniques, is that solutions to problems, conundrums or perceived diametrically opposing facts can often be found by studying early developments in particular technologies. The approach that the manufacturer applied to the technology or how research and application found another way through may provide the solution for students, examiners and experts.

TEST SIM Script
(NOTE: The only details I have for the Author "brka". The email and website are no longer active. It is possible that the test materials are compiled from different sources and brought together in one source file. Some of the materials seemed to be have recognisable or at least similar designs to that created by the known programmer/developer "Dejan"). 

Once when you make TEST SIM using test_sim.hex you can:

          Entering into TEST mode
        ***********************

Insert TEST SIM in your phone.
Power ON phone.
When phone ask for PIN, type 5555
Then, the phone displays "CHECK CARD",
and then Power-Off the phone and Power-Up
The phone will enter into the TEST mode ....
(it can Register on ANY network ... but no Phone calls
can be done)

          Entering into CLONE mode (SP Unlocking)
          ***************************************

Insert TEST SIM in your phone.
Power ON phone.
When phone ask for PIN, type 1111
Phone will display "CHECK CARD"
Wait for few seconds and turn OFF phone!!!
Now turn phone ON and phone will be in CLONE Mode!

Clone Mode works on all Motorola phones!


          SP Unlocking
         ************

Once you are in Clone Mode, type  03# and phone will be unlocked.
NOTE!  SP unlocking work on all Motorola phones made before Sep.98!!!
It even works on some of CD920 and CD930 ....

Try it and please write me the results ....
(I found that the phones that IMEI ends with 0 can be unlocked !)

TEST SIM can be made with PIC 16F84 (16C84) wafer card.

***************************************
test_sim.hex
***************************************
This test file is still available on the internet

Tools
PICkit - http://www.microchip.com/Developmenttools/ProductDetails.aspx?PartNO=PG164130

Propic2 Clone - http://cuteminds.com/index.php/en/propic2

Disclosure to Defence, Opinion and Bayesian Statistics

Disclosure to Defence, Opinion  and Bayesian Statistics

The reported outcome from the trial and appeals of R v Adams ( [1996] 2 Cr App R 467, [1996] Crim LR 898, CA and R v Adams [1998] 1 Cr App R 377, The Times, 3 November 1997, CA) rulings was the Courts ousted explicit Bayesian statistics from the reasoning admissible before a jury in DNA cases. However, calculating the probabilities for say cell site analysis activity/location, partial recovery of a file's data and its likelihood to being a particular image etc using Bayesian, I do not to suggest that this case disbars individuals from using it in their analysis. Importantly, the case opens the doors of transparency in relation to revelation of previous consideration about its use for evidence, what measures the person has been taken to prevent assumptions about unproven facts implied as accurate and so on.

To assist the transparency principle, it should be understoood a fundamental tenet of forensics is the practice of open, free and frank discussion and disclosure about pitfalls, flaws or unsolved errors in practices, process or procedure should not be avoided.

To illustrate some ideas of lacking in transparency.  If an examiner uses eg machinery that is out of date or flawed in its operation, then clearly it is not the manufacturer that is at fault. The examiner applies the use of the machinery to obtain, produce or treat the evidence. The examiner, it is expected, who uses the machinery should understand the technicality and science in which they are involved and be able to determine in advance of the machinery use its capability (drawbacks/limitations) when assessed against known facts and requirements. Moreover, to warn about issues if the machinery then produces random output upon which its user then decides to opine statistics, probabilities and theorems being drawn from the output of the machinery.

To suggest two of many cases where we may apply the above illustration:

Case 1: would the occurrence of a mobile station using a particular set of Masts in a four hour period suggest the MS was within a defined area? The radio test equipment used to conduct tests would be unable to confirm if the operator uses "directed retry" as to an MS's call history, as the radio tests conducted are post event. The knowledge the user of the equipment must have is where to get that information if it cannot be obtained from the test results?   Without knowledge of directed retry to produce statistics about occurrence could amount to opining random speculation.

Case 2: IPhone is a popular smart phone. The release of iOS5 introduced 'iMessaging' - a messaging service for texts, emails etc using the cellular network or WiFi as the transport paths to communicate messages. 'iMessage' falls under the iPhone Message App which is equally shared with 'SMS text messaging' - which is only sent over the cellular network. An interesting feature with iMessage is that messenging with another iOS5 device it highlights the message in 'blue'. Moreover, where the user's iPhone uses a previous OS (iOS4 or earlier) the messages appear 'green'.  However, a further distraction from the straightforward blue/green operational scenario is where an iOS5 device communicating to another iOS5 device using iMessaging starts off in blue but then turns to green? Avoiding the issuesassociated with identity and origin, there are huge possibilties to spend hours calculating or producing statistics about the content of a message, but what happens when consideration is given to the blue/green paradox and the handset reading software tool fails to identify detect which messages are blue or green?

At the top end, using quantifying techniques like Bayes to opine a theory from which a conclusion can be drawn can be fraught with flaws in the absence of knowledge, skill and experience about the science subject matter in which the person works. The same can be applied at the other end, by avoiding those with knowledge, skills and experience for simple platitudes, dumbed down evidence or psychologically trickery (getting others to do what you want them to do) to avoid answering the question can lead to the production of a philistine opinion/conclusion.

Turning to another point about this case. A useful influence that has also been reported that arose in this case during the various hearings and appeals apparently led to both experts required  to consider the expert findings in order to respond to two fundamental questions. In order for that to be achieved "The scientist adducing the 'DNA comparisons'  should do so with his calculations of the random occurrence ration. Whenever such evidence is to be adduced, the Crown should serve the defence with details of how the calculations have been carried out, sufficient to enable the defence to scrutinise the basis of the calculations. The forensic science service should make available to a defence expert, if requested, the database upon which the calculations are based."

If we are to reflect how the need for proper and transparent disclosure and the equal treatment of the defence expert may be put into practice for calculations and databases, examples could be expressed as:

Handset and SIM/USIM Data Acquisition - complete acquired (not partially acquired) data in those devices to be disclosed to the defence; disclose report and identify standards etc and any opinion formulated

Cell Site Analysis - disclosure of radio test measurements, surveys, materials from relevant mobile network operator/s and confirmation of all material considered and disclosed (including handset/SIM report; call records; cell site etc)

Call/Billing Record Analysis - disclosure of billing, CDRs, TAP and IRA/IOT roaming records, IMSI/IMEI analysis, voice and data usage etc

As cases, like Adams, do not appear to have been overruled for upholding established principles, it would be odd to see them overlooked in times of economic cutbacks: eg " a good day to bury bad news " approach were it to be inferred or implied:

- disclosure to be costly,
- causes difficulty to those who seek to simplify evidence because they do not technically understand the evidence (and the logical and natural consequence of the latter),
- the dumbing down of evidence.

A strong supporting tenet in the doctrine of disclosure is the linked parallel requirement for appropriate and necessary experience and competence of the expert to deal with the compiling or assessment of the evidence. That is, as opposed to an inexperienced or less experienced person or a person indirectly involved in the science/technology element of the evidence being encouraged to have a stab at interpreting the evidence.  Such examples, where society would most probably find the latter notions abhorrent were they to be practiced by one party or another, and quite rightly so, can be suggested as:

a) an anesthetist assisting a brain surgeon in theatre (thus working in close proximity, similar as one may do in a company) :- should the anesthetist be asked to opine about surgically gaining access to a brain tumour or the likelihood of the success/failure of such surgery?

b) a barrister who has dealt with 40 cases of dentist mistreatment should s/he be asked what procedure is needed for removing impacted wisdom teeth or the likelihood of success/failure of removing the impacted teeth?

c) the analogies above applied to persons involved with DNA, blood sampling, fingerprinting and technology evidence etc... may equally draw opinion on a view society may take?

d) where the person being asked to give opinion has far less experience is preference over highly experienced persons? 

The discussion in this thread is not to argue or advise on law (as I am not holding out to do so), nor am I qualified in this area, nor am I suggesting seeking the advise of anyone other than those who are highly experienced in eg law. The discussion is to identify a case and expose how it can highlight unnecessary challenges placed on the standards and quality of evidence that may arise, introduced by poor opinion or opinion generated from over-confident attititude of inexperienced or less experienced individuals. 

Additional case reference: R v Doheny and Adams [1997] 1 Crim App R 369.

Evidence and Admissibility Part 2

Evidence and Admissibility Part 2

.

In the first discussion on Evidence and Admissibility that appeared in Part 1 there was reference made to the International standards ISO17025 and ISO17020 and their proposed use as laboratory standards suited to forensics and evidence - http://trewmte.blogspot.com/2010/06/evidence-and-admissibility-part-1.html . In Part 2 further reference is made to ISO17025, the Forensic Science Regulator and UKAS and the Diplomas and their potential future influence dealing with evidence and admissibility. The purpose of making reference to these matters allows comparison to made between past technical, forensics and evidential events and potentially where the future lies when dealing with mobile telephone evidence.
.
The FSR (Forensic Science Regulator) as we know has identified a standard for laboratories that is said to be directly applicable to the field of digital mobile telephony, which is ISO/IEC 17025. To recap on background information; this is the main standard used by testing and calibration laboratories. This standard was formally known as ISO/IEC Guide 25. This standard contains many commonalities with QA standard ISO9000. When the second release of ISO17025 occurred in 2005 it did so based upon the agreement that its quality system wording was closely aligned with IS09000 version 2000. Readers may remember I referred to adopted principles in ISO17025 and QA standards in my previous posting Evidence and Admissibility Part 1.
.
So why is ISO/IEC 17025 applicable to all experts and examiners? Significantly, unlike ISO9000 and BS5750, this standard introduces the concept of, and the requirement for, 'competence' of the individual to be included into the equation because the standard applies directly to those organisations that produce testing and calibration results. The fit for purpose requirement of tools is set out under a different requirement, which is 'validation'. In order for 'tools' to remain valid equally relies upon the individual's competence, and at minimum should be:
.
a) Possess the highest competencies or attain them if the organisation is to rely on the individual to work with a tool;
.
b) To have been independently assessed by long-term experienced and skilled individuals as opposed to tool suppliers merely approving to get the sale of a tool;
.
c) Know what the 'tool' does;
.
d) Have the skills to assess whether the 'tool' is technically failing or systemically flawed in its operation;
.
e) To be able to maintain the 'tool's' performance - equally means maintaining an individual's skills;
.
f) To know and understand the requirements of future-proofing and sustainability.
.
How can the above be achieved? For sometime there has been a call for Mobile Phone Forensics Degrees but the Universities failed to take up the proposition. From enquiries made into this matter, it became clear the Universities, despite producing MSCs with one or half of one module containing something on mobile phone examination, the Universities do not have the competencies and skillsets for the work, nor could they identify the materials needed for the degrees or have the ability to assess student competence. That arises because the area is a specialism, thus requires a specialist approach and therefore this is no poor reflection on the academic brillance of Universities. So in this regard it makes no criticism of the Universities for not offering every specialism in the marketplace. This is why the Diplomas (http://trewmte.blogspot.com/2010/05/diplomas-mobile-telephone-evidence.html) have been introduced to solve this particular dilemma in the marketplace given the tens of hundreds involved with this field of distinction. The Diplomas provide a stepping stone to recognising 'competence', which currently examiners are being denied. Moreover, the modules have been prepared in the Diplomas to follow a similar structure to the way in which a student would undertake an MSC.
.
Another area where the Diplomas assist is in relation to cost. Currently MSC degrees cost between £3K to £7k per annum. The latest reported news in the media is that these tuition fees are set to increase even higher, maybe even skyrocket. The Diplomas work the other way around, the more modules you undertake the lower the costs become due to the way the discounts work. The encouragement to undertake the Diplomas therefore doesn't just include imparting real-world knowledge and experience passed on by seasoned professionals, but incentive discounts offered by uptake of the modules enables the securing in-advance of the professionals time which otherwise wouldn't be possible. Furthermore, and at the same time, they offer affordability to students.
.
Why is the way forward given above a better way than the current status quo? Neither the Forensic Science Regulator (FSR) or UKAS can approve the 'competence' of individuals for each particular field of forensic /evidential distinction. Universities as we know do not have the skillsets necessary to rollout degree courses in mobile telephone evidence. Specific to our field of distinction, the Mobile Telephone Examination Board (MTEB) was set up specifically to address peer review; the Diplomas are one way to gain peer review leading to recognition through the MTEB. The foundation to each of the modules in each of the Diplomas map principles to be found in simulated annealing for deterministic and random events that are often understood to be the basis of how evidence from mobile telephone usage occurs. The Universities gain from Diplomas as they work in harmony with them to aid students find the academic path to follow for a specific subject rather than the current way of devaluing and diluting other sciences and forensic fields to build up modules introduced into hybrid technology degree courses. So we need to understand the influences and impact of the quality or state of existing in or assuming different educational forms (generically speaking, polymorphic).
.
The future of mobile communications and its impact on society will grow even more than hitherto it has. The driving forces for this can be traced as much to remarks on future Global economies by industry illuminaries such as the head of LM Ericsson, the largest telecommunications manufacturer, when he said the future is "wireless" as much to the growth in smartphones and wireless smart devices and the newer wireless transmission and protocols, functionality and applications introducing diversity in the wireless world that looks set to surpass the cable world. However, to meet those exciting and progressive markets, Business can no longer afford to wait for degree students to flock out from Uni after 3 years and then spend another 1-2 year/s bringing them up to speed in the fast-changing wireless environment.
.
An example of fast-changing wireless environment which identifies sustained regular change can be found in the wireless standards used nationally and globally:
.
_____________________________________________________________
3GPP specifications
The term "3GPP specification" covers all GSM (including GPRS and EDGE) and W-CDMA specifications. The following terms are also used to describe networks using the 3G specifications: UTRAN, UMTS (in Europe) and FOMA (in Japan).
.
Revised versions of many of these specifications are produced up to four times a year following the quarterly TSG plenary meetings (TSG GERAN meets five times a year.)
_____________________________________________________________
.
The Diplomas take all of those conditions above, turn them around and re-work them. Students pursue the business goals first, being effective and self-managed at work, and then use the academic route to refine and hone particular, finite skills to optimise the end result for the benefit of the business. This model can assist Universities to get students wanting to achieve the technical hardcore goals in order to develop products, systems and services tailored from the diversity of the business enterprise and working environment. This can be so because the student's constructive thought process is based upon real-world exposure, not school-to-university idealogical observations. Moroever, there are examiners already working in the field who (a) have not had a fair opportunity to have their competencies recognised by (b) their peers and in the community. The Diplomas remove that unfair stigma for those mobile phone examiners being treated as second class.
.
So what are some of the future evidence and admissibility issues to be considered?
.
1. Recognised competence so reliance is NOT solely placed upon the tool; thus the removal of "push-button forensics" used to side-step the need for competency
.
2. Validation of tools will come about (thus side-stepping compliance is unavoidable). Indeed one particular tool developer agrees validation is entirely achieveable. So this is a step forward for validation, but again does not of itself qualify the 'competency' of the individual if trained to use the tool beyond gaining exposure to the tool's operation and use, but not the detail of the subject matter of the science, the technology using the science or, indeed, interpretation of outcomes or data.
.
3. Item 2 (above) is really a further qualification as to why the FSR and UKAS do not appear as candidates to qualify/recognise individual 'competency' in the subject matter or science.
.
In the next part, Part 3, the discussion deals with specific technical issues and their impact on evidence and admissibility.